Passwords stay on the gateway
Passwords and SSH keys of the target servers are stored encrypted on the gateway, which signs in itself. A user cannot see, copy or take them away; not even an administrator can read a stored password — only replace it.
One recorded gateway between your administrators and your servers
BURSU PAM is a privileged-access gateway. People connect to the gateway, not to the server: it signs in to the target with a password they never see, records the session, lets an auditor watch it live and end it, and writes every action to an audit log that shows any later edit. The gateway, its database and the recordings stay on your premises.
How it works
The gateway signs in, the person never gets the password
The gateway is one service on your own server, next to its PostgreSQL database. A person signs in to it, the gateway checks the access rule for that person, server and account, opens the connection to the target itself with the stored secret and passes the session through, recording it.
- Sign-in: a password and a one-time code, a directory account or Kerberos.
- Rule check: who, which server, which account, when, and whether the terminal, file transfer and the clipboard are allowed.
- Sign-in to the target: the gateway decrypts the account's secret and checks the target's host key or certificate.
- Recording and live view: an auditor can watch the session and end it.
- The end: the recording is closed and signed, the events go to the audit log and to your SIEM.
bursucm.com never sees a session. It only issues licences, and the gateway calls it only when an administrator presses an online button or turns on the daily check-in. Without internet the gateway works fully: a licence comes in by a request code.
What the gateway does
Everything a privileged session needs, on one server you run.
Every session recorded
Terminal sessions as text you can search by what was typed, desktops as video with seeking and MP4 export, database sessions as the list of queries that ran.
Watch live, end at once
An auditor watches a session while it runs and can end it. A session also ends when its rule expires or is deleted.
Access rules
Who may connect to which server, under which account, when — and whether the terminal, file transfer and the clipboard are allowed, rule by rule.
Requests and approvals
A user asks for access for a time, an approver approves or declines it. Emergency (break-glass) access comes with a mandatory review afterwards.
Command control
Dangerous commands in an SSH session can be refused, or sent to an approver to confirm during the session.
An audit log that shows tampering
Every event is chained to the one before it by its hash, with regular checkpoints; the integrity check finds a row changed or deleted in the database. Recordings are kept with signed manifests and hashes.
Your SIEM gets every event
Audit events go out over syslog (RFC 5424) in CEF, LEEF or JSON.
Sign-in your way
Local accounts with a password and a TOTP code from an authenticator app, plus recovery codes; Active Directory and LDAP accounts; Kerberos single sign-on.
Four roles
Administrator sets up the gateway, User connects and asks for access, Approver approves requests and commands, Auditor watches sessions and recordings, reads the logs and checks their integrity.
On your premises
The gateway, its database, its keys and the recordings are on your server. The master key lives in /var/lib/bursu-pam/keys, not in the database, so a copy of the database alone opens no secret and no recording.
A web console in eight languages
English, German, Spanish, Portuguese (Portugal and Brazil), Russian, Ukrainian and Georgian; each user picks their own. The console also works without JavaScript.
Protocols and clients
People keep the programs they know and point them at the gateway instead of the server.
| Protocol | Gateway port | Clients |
|---|---|---|
| SSH, SFTP, SCP | 2222 | OpenSSH, PuTTY, WinSCP, FileZilla, BURSUcm |
| Telnet (network devices) | 2222 | any SSH client, BURSUcm |
| RDP | 3389 | mstsc with an .rdp file, BURSUcm |
| VNC | 5900 | VNC viewers, BURSUcm |
| PostgreSQL | 15432 | psql and programs with a window, BURSUcm |
| MySQL / MariaDB | 13306 | mysql and programs with a window, BURSUcm |
| Microsoft SQL Server | 11433 | sqlcmd and programs with a window, BURSUcm |
These are the default ports; bursu-pam-configure changes them. Port 22 stays with the server's own SSH. The web console and the BURSUcm sign-in are on 443. Let the target servers accept SSH, RDP, VNC, Telnet and database connections only from the gateway's address — otherwise a person who learned a password elsewhere connects around it, unrecorded.
BURSU Connection Manager
One double-click, no password on the device
BURSU Connection Manager has a fourth storage mode next to BURSUcloud, PostgreSQL and local: PAM Gateway. The person signs in with the gateway login, password and code — or with Windows or Kerberos — and sees only the servers the rules allow.
- A double-click connects: the app asks the gateway for a one-time ticket, valid for 60 seconds and one connection, and uses it. No server password ever reaches the device.
- SSH, Telnet, RDP, VNC and databases; the server's files over SFTP, as far as the rule allows.
- Access requests are filed from the app; the catalogue is read-only.
- From BURSUcm 5.5.1 on Windows and 3.3.7 on Linux and macOS.
Trust, sign-in and recording
- The gateway's certificate is confirmed by its SHA-256 fingerprint the first time, and a changed one is refused.
- The sign-in lasts as long as the administrator sets — 8 hours by default — and signing out ends the sessions it opened.
- Each session is recorded on the gateway, exactly as one opened with any other client.
Install
Linux is the beta platform: a package for Debian / Ubuntu, Fedora / RHEL or Arch, or the signed repository, so that new versions arrive with the system's own updates. A Windows package follows.
Linux BETA
Coming soon
This package is being built; the repository gets it at the same time.
Coming soon
This package is being built; the repository gets it at the same time.
Coming soon
This package is being built; the repository gets it at the same time.
After the package
Windows
Coming later
The Windows package of the gateway follows the Linux beta.
BURSU Connection Manager, the client, runs on Windows, Linux and macOS and connects through the gateway in its PAM Gateway mode.
Licensing
Licensed by the number of target servers switched on in the console; users are unlimited. For a quote, write to sales.
7-day trial
Every feature, up to 25 active servers, for 7 days. It starts on the gateway's licence page after the first-run wizard: one call to bursucm.com when the gateway is online, or a request code pasted on bursucm.com/pam/activate when it is not.
A signed licence file
A paid licence is a file signed by BURSUsofts, bound to the installation and its server. The gateway checks it offline for its whole term: there is no remote switch that can turn your gateway off.
When a licence ends
A soft stop, not a shutdown. After the term — and for a paid licence the grace period written in it — new sessions and console changes are refused. Audit, recordings, SIEM export, live view and ending sessions keep working.
Quote from sales
Tell us how many servers the gateway will reach. A paid licence is issued to your bursucm.com account and activated with a key, online or by a request code.
Your licences
Licences, trials started offline and claimed installations belong to a bursucm.com account. Sign in to see yours.
The BURSU PAM guide
Installation, the console, every role, the clients and what each message means — in English, Russian and Georgian.
Questions before you install?
Write to us about a pilot, a quote or an integration.